Weaknesses of type CWE-134

144 results

Uso de string de formato controlada externamente

Ocorre quando a aplicação passa uma string vinda de entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou logging. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler ou escrever dados arbitrários na memória, comprometendo confidencialidade e integridade.

Example

Um programa web recebe um parâmetro 'nome' do usuário e faz `printf(nome)` em vez de `printf("%s", nome)`. Um atacante envia 'nome=%x.%x.%x' e consegue vazar dados da pilha; ou usa '%n' para sobrescrever endereços de memória.

How to mitigate

Nunca passe entrada do usuário diretamente como string de formato. Use sempre um formato fixo: `printf("%s", entrada_usuario)` em C, ou equivalente em outras linguagens. Em logs, sanitize ou use APIs de logging estruturado que não interpretam strings de formato.

CVE-2023-22374HIGHiControl SOAP vulnerabilityEPSS 72.6%CVE-2024-23113CRITICALA use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FoEPSS 61.7%KEVCVE-2019-1579HIGHRemote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or EPSS 46.0%KEVCVE-2023-35086HIGHASUS RT-AX56U V2 & RT-AC86U - Format String -1EPSS 38.5%CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2017-0898—Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus valEPSS 9.7%CVE-2019-13318MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User intEPSS 5.8%CVE-2025-48826HIGHA format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP rEPSS 4.4%CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.4%CVE-2020-1992HIGHPAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalationEPSS 3.4%CVE-2023-4746HIGHTOTOLINK N200RE V5 Validity_check format stringEPSS 3.2%CVE-2021-32785MEDIUMFormat string bug in the Redis cache implementationEPSS 2.7%CVE-2022-26674CRITICALASUS RT-AX88U - Format StringEPSS 2.6%CVE-2017-3859—A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow anEPSS 2.5%CVE-2021-41193CRITICALUse of Externally-Controlled Format String in wire-avsEPSS 2.5%CVE-2022-3724MEDIUMCrash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file onEPSS 2.3%CVE-2017-12702—An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiersEPSS 2.3%CVE-2021-20307—Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary mEPSS 1.9%CVE-2012-10055CRITICALComSndFTP v1.3.7 Beta USER Format String RCEEPSS 1.6%CVE-2022-40604HIGHFormat String VulnerabilityEPSS 1.6%